secure database secrets and ensure middleware access #423
Conversation
ops/terraform/main.tf
Outdated
| @@ -98,6 +98,10 @@ module "ocr_autoscale" { | |||
| weekend_capacity_instances = 1 | |||
| } | |||
|
|
|||
| module "vault" { | |||
| location = data.azurerm_resource_group.rg.location | |||
There was a problem hiding this comment.
We should pre-create/manually create vault secrets ahead and bringing them in as data sources similar to how we are with the Resource Group's, like this for example: https://github.com/CDCgov/prime-simplereport/blob/593c56c62847fbf398a0a8cddc5e4069a1499bd1/ops/prod/_data.tf#L50 This is also how CDC azure access will be.
I do agree that we should make things repeatable for whoever follows, however the type of 3tier'd cloud design we have isn't meant to be repeatable. It's meant to reside in a central location and not be able to scale to other organizations as well as other designs.
Unfortunately it looks like we might not have permissions to create key vault secrets at the moment in Azure. I ping'd Josh earlier to see if he can add a role to allow it.
There was a problem hiding this comment.
We met with Josh Dorothy on Tuesday, November 26 and received permissions. In that meeting you agreed on this architectural design. In that meeting, I re-iterated the manual creation of the secret may not be the best practice or most secure.
marycrawford
changed the title
marycrawford
force-pushed
the
415-db-secure-db-secrets-and-ensure-middleware-access
branch
from
28c3096 to
d49dfe8
Compare
| @@ -30,9 +30,11 @@ services: | |||
| ports: | |||
| - "5432:5432" | |||
| environment: | |||
| POSTGRES_DB: reportvision | |||
| POSTGRES_USER: postgres | |||
There was a problem hiding this comment.
We might need to make a separate app.yaml file but this is something we can handle as part of next steps. This looks ok!
marycrawford
deleted the
415-db-secure-db-secrets-and-ensure-middleware-access
branch
Description
Utilize infrastructure as code to automate the creation of the database user and secrets, as well as keeping it secure by storing it in Azure key vault. Passing the values to the middleware to access (while still making sure security is added with the sslmode).
Related Issues
[Link any related issues or tasks from your project management system.]
Checklist